Live › vulnerability › CVE-2026-116165
Go to dashboardParse Server deployments on MongoDB let clients without the master key send REST delete requests against the internal _SCHEMA collection. An attacker can remove field definitions, class-level permissions and protected fields, exposing data to unauthorized reads and changes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 14:41 UTC. All times on this page are UTC.
Applications that run Parse Server on MongoDB and expose its REST API to clients without the master key are exposed. Deployments on other databases, or servers reachable only from trusted internal systems, are less exposed; the sources do not say whether other databases are affected.
No product ranges from the sources yet.
npm ls parse-server and confirm whether it is below 8.6.101 or in the 9.0.0 to 9.10.4-alpha.3 range.8.6.101 or later on the 8.x line.9.10.4-alpha.4 or later on the 9.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.
This page as .md · .json · in your agent: get_signal("CVE-2026-116165")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.